The agent decides autonomously whether, when, and how to retrieve — issuing and reformulating queries, selecting among sources, grading the relevance of returned passages, and iterating or skipping retrieval — instead of unconditionally retrieving once before generation. Named variants: Self-RAG (reflection tokens gate retrieval), Corrective RAG / CRAG (an evaluator scores evidence and triggers re-retrieval or a web fallback), GraphRAG (a knowledge graph for multi-hop questions), and RAPTOR (hierarchical tree-structured retrieval for long material).
In practiceA product-support agent re-queries its policy corpus with a refined term when the first retrieval scores below a relevance threshold, rather than answering from the weak hit.
When to reach for it
When it backfires
The tradeoff
Higher relevance and recall are bought with extra LLM calls, added latency, and a larger failure surface (mis-decided retrieval, query-reformulation loops).
Relevant passages are retrieved before generation.
When no passage clears the relevance bar, the agent keeps reformulating and re-querying. Without a ceiling it burns tokens and latency chasing context that may not exist in the corpus.
Fix · Bound the loop: cap reformulation rounds, and on exhaustion fall back to answering from what was retrieved (or declaring the gap) rather than looping again.
A passage scores high on embedding similarity yet does not actually contain the answer. The grader waves it through, and the agent grounds a confident answer on evidence that never supported it.
Fix · Grade for answerability, not similarity: require the passage to actually support the claim (an entailment / does-it-contain-the-answer check), and cross-check across sources before generating.
Threat exposure
Adopting this pattern opens these attack surfaces. Each links to its entry in the threat model.
Full threat model →Search patterns, frameworks, and pages.